Skip to content

Decrypt a secret

POST
/decrypt

Decrypts an age-encrypted secret using the server’s private key. Only available on port 6021 — never exposed publicly.

The CLI uses this for holden vars get --show-secrets.

Base64-encoded age ciphertext (armor headers stripped)

string
Example
YWdlLWVuY3J5cHRpb24ub3Jn...

Decrypted secret value

string

Missing ciphertext

Decryption failed